Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.67.origin
Сетевая активность:
Подключается к:
- s####.####.com
- u####.####.com
- set####.####.com
- a####.####.net
- o####.####.com
- r####.####.com
- bina####.####.com
- 1####.####.253
- a####.####.com
Запросы HTTP GET:
- a####.####.net/v4/plugin/recommend?version=####&channel=####&language=####&t=####&aid=####&o1=####&gid=####
- a####.####.net/v4/user/boot?wl=####&bl=####&ol=####&rc=####&bn=####&bv=####&hw=####
- a####.####.net/v4/plugin/transrecm?version=####&channel=####&language=####&t=####&aid=####&o1=####&gid=####
- a####.####.net/v4/bizplan/pkg
- a####.####.net/oversea/v3/dealMessage?imei=####&mac=####&versionCode=####&version=####&channel=####&lmTime=####&productId=####&language=####&startWith...
- r####.####.com/easemob/server.json?sdk_version=####&app_key=####&file_version=####
- a####.####.net/v4/bizplan/show
- u####.####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&prod=####&svn=####
- a####.####.net/v4/plugin/vs?version=####&channel=####&language=####&t=####&aid=####&o1=####&gid=####
- bina####.####.com/Izapya/socialmedia/Indian_miko.jpg
- a####.####.net/v3/plugin/vip?version=####&channel=####&language=####&t=####&aid=####&o1=####&gid=####
- a####.####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&prod=####&svn=####&sv=####&nv=####
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation...
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&ori...
- a####.####.net/v4/plugin/open
Запросы HTTP POST:
- a####.####.net/user/runLog/json
- 1####.####.253/dewmobile/kuaiya/devices
- a####.####.net/v4/plugin/stat
- o####.####.com/v2/check_config_update
- o####.####.com/v2/get_update_time
- a####.####.com/detail/getOfferListNew?enc=####
- a####.####.net/v2/message/stat
- a####.####.net/v3/action
- a####.####.net/v3/users
- s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/server_info.xml
- /data/data/####/data.log
- /data/data/####/shared_prefs/apsad.xml
- /data/data/####/databases/cc.db-journal
- /sdcard/Android/data/####/cache/volley/20164800331551185019
- /data/data/####/shared_prefs/apsad.xml.bak
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/z_wblist.xml
- /data/data/####/shared_prefs/event_flow.xml
- /sdcard/Android/data/####/cache/volley/-1569660365-1734728509
- /data/data/####/databases/cc.db
- /sdcard/Android/data/####/cache/volley/-1414830958-1066056720
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/files/config.json
- /sdcard/.androidsystem/.files/gads.db
- /sdcard/Android/data/####/cache/volley/-202614468-673542171
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/device_id2.xml.xml
- /data/data/####/shared_prefs/z_wblist.xml.bak
- /sdcard/Android/data/.nomedia
- /data/data/####/files/google.db
- /sdcard/Android/data/####/cache/volley/-49184101684891278
- /sdcard/Android/data/####/cache/volley/15524226371984292515
- /data/data/####/files/server.json
- /data/data/####/databases/transfer20.db-journal
- /data/data/####/shared_prefs/onlineconfig_agent_online_setting_####.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/shared_prefs/AdsBusiness-data.xml
- /data/data/####/files/.imprint
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/####/cache/volley/-1414830958-2108495103
- /data/data/####/shared_prefs/apscomm.xml
- /data/data/####/databases/plugin20.db-journal
- /data/data/####/shared_prefs/localUser.xml
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/app_mbj/dex/classes.zip
- /data/data/####/shared_prefs/z_rules.xml
- /sdcard/zapya/.cache/.i
- /data/data/####/databases/mobvista.msdk.db-journal
- /data/data/####/shared_prefs/aps.xml.bak
- /data/data/####/shared_prefs/server_info.xml.bak
- /data/data/####/files/exid.dat
- /data/data/####/shared_prefs/mobvista.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/Android/data/####/cache/volley/-1569660365-2116477840
- /sdcard/baidu/AndroidStore/http_cache/journal.tmp
- /sdcard/Android/.i
- /data/data/####/shared_prefs/DewMobileApi.xml
- /data/data/####/databases/ua.db-journal
- /sdcard/baidu/.cuid
- /data/data/####/shared_prefs/aps.xml
- /data/data/####/databases/search.db-journal
- /data/data/####/shared_prefs/app_banner_new.xml
- /data/data/####/databases/download.db-journal
- /data/data/####/files/umeng_it.cache
- /sdcard/Android/data/####/cache/volley/134794920291417387
- /data/data/####/shared_prefs/z_olparams.xml
- /data/data/####/databases/job.db-journal
- /data/data/####/shared_prefs/localUser.xml.bak
- /data/data/####/shared_prefs/appsflyer-data.xml.bak
- /sdcard/_zy_1485418358931_zy
- /sdcard/Android/data/####/cache/volley/-5618312651946880067
- /data/data/####/shared_prefs/z_hw_list.xml
- /sdcard/.z
- /data/data/####/shared_prefs/appsflyer-data.xml
- /data/data/####/shared_prefs/AdsBusiness-data.xml.bak
- /sdcard/zapya/doodle/.nomedia
- /data/data/####/shared_prefs/z_time.xml
Другие:
Запускает следующие shell-скрипты:
- mount
- /data/app-lib/####-1/libobserver.so /data/data/####/data.log
Может автоматически отправлять СМС-сообщения.
